I've got some Heroku projects, which don't have a static ip. How do I protect myself against this?
New ‘Meow’ attack has deleted almost 4k unsecured databases
191–200 of 544 posts
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#192If the databases in question (Elastic, MongoDB, others) make it too easy to set up unsecured access, possibly because they default to an unsecured state on installation, then some good may come of this: The reputation hit to the database vendors should encourage them to mend their ways. If that happens, then the attack can arguably be justified despite the damage — consider all the future database installations which…
Apparently these guys don't have a firewall setup and haven't heard about private networks and VPNs.
reads TFA again Wait, one of the victims is a VPN provider???
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#193I've got some Heroku projects, which don't have a static ip. How do I protect myself against this?
Simply set a secure password on any DB instances exposed to the internet.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#194Earlier quoted context omitted.
So you are rationalizing a crime because it teaches companies a lesson? That is a crazy rejection of the rule of law. Would you be comfortable in applying that logic to all crimes?
I'm not gp, but let's take a step back for a sec. (I've mostly lived in the northeastern US) I live in a small (~20k population) rural technically-city (but... it's a town) where crime is not much of an issue; my car sits unlocked in my driveway and I seldom lock my house -- when I do, it's almost always when I'm at home (alone) -- it's about a feeling of security, not any real risk of a break-in. I've lived this way…
I agree with all that and I also don't want to let the perpetrator off the hook. In your example, doesn't matter if the crime happens in a place where it is uncommon or not, it is still a crime and we shouldn't excuse the perpetrator by suggesting that the victim needed to be taught a lesson.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#195It's stuff like this that reminds me that the internet is in many ways still in a loosely regulated, "Wild West" state. This is pretty clearly willful destruction (I.e. vandalism; https://legal-dictionary.thefreedictionary.com/Willful+damag...). It's illegal in the real world, and should be illegal in the digital world. A lot of people are saying that organizations that had these DBs in public "had it coming", or "now they'll learn." What's a real world parallel for this? If an organisation is putting its customers at risk, you can report them. In these cases, companies with insecure data stores are putting their customers at risk by exposing their data. Is there anyone you can report them to? Is there any organisation that will hold them accountable to actually make changes?
I'd also note that not all DBs contain other people's data. Those have no moral concerns with bring public. There is a risk that someone will destroy it, but I'd say that's the same risk taken with public art or something. Yes it's public; yes someone can destroy it; yes it's illegal for someone to destroy it (even though it's public); no, the fact that it's public is not illegal.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#196Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#197If the databases in question (Elastic, MongoDB, others) make it too easy to set up unsecured access, possibly because they default to an unsecured state on installation, then some good may come of this: The reputation hit to the database vendors should encourage them to mend their ways. If that happens, then the attack can arguably be justified despite the damage — consider all the future database installations which…
Why not just rename all the tables or something? That's enough to get the developer's attention without being so destructive.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#198Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#199Earlier quoted context omitted.
Thr victims are the unaware customers who's data has been stolen because the company wasn't providing security. If a business left the store open with the customers credit cards details on display. Anyone passing by can go in and copy that info. Someone sees this and burns the exposed records. Perhaps they helped the victim. Remember no one burned the store down or the table holding the records. They burned only the…
You don't know who was the storage vendor and who's data was being deleted and you have no idea what that data represents or what the consequences are of having to restore it. You are making several unfounded assumptions.
No one knows more information than the article presents.
When you state that victims exist or that the data being deleted is important you are also making unfounded assumptions.
You can't have it both ways.
Re: New ‘Meow’ attack has deleted almost 4k unsecured databases
#200Earlier quoted context omitted.
I think this is a little simplistic. Depending on what data is being deleted, it may have real life economic consequences for individual people. What if one of the databases has a record of credits you've purchased at your local spin studio? Hopefully they have a back up, but if they don't, you and/or the owners stand to make significant losses. Are there databases that could be lost without consequence except to the…
It can definitely have real world consequences, but couldn't the same be said for somebody being a whistleblower for a company that doesn't following building codes? The company could take a huge financial hit and people might lose their jobs because of their practices being exposed.
>> but couldn't the same be said for somebody being a whistleblower for a company that doesn't following building codes?
No. The equivalent would be exploiting their buildings weakness to cause them to collapse - maybe with people in them.
Pointing out a vulnerability is not the same as demonstrating it.
That said, a demonstration will get their attention more.